How Do I Report a Security Vulnerability?
Report security vulnerabilities privately through the Help Center form with Request Type Bug Bounty / Vulnerability. For Critical issues only, also email security@bankr.bot with a short summary and a link to your ticket.
What to Include
Every report needs a clear, step-by-step reproduction and a working proof of concept. Reports without one may be closed as informational. Include the affected asset (endpoint, contract address or component), what an attacker gains, and how to reach you.
Testing Rules
Use accounts you create and control to show access across accounts.
Don't move, drain or test against real user funds.
Demonstrate contract issues on a local fork or testnet, never on mainnet.
No DoS, load tests, spam or high-volume scans against production.
No social engineering of Bankr staff, users or vendors.
Stop and report as soon as you've confirmed impact, then delete everything you obtained.
Keep It Confidential
Don't open public issues, and don't disclose a finding, publicly or privately, without Bankr's written consent. That holds even after the fix ships.
Rewards
Rewards are discretionary and decided after review, based on demonstrated impact.
Only the first reporter of a previously unknown issue is eligible, and multiple reports of the same root cause count as one.
Anything you send about a report after submitting it is part of that report.
Before any reward is paid, you sign the Researcher Declaration and Release, which Bankr sends from your ticket. In it you confirm you've deleted the data you obtained, agree to keep the finding confidential, and confirm you meet the eligibility conditions. A reward offer lapses if the signed declaration isn't returned within 30 days.
After You Report
Follow up on the same ticket, and reply there if a report seems stalled. Don't open a new ticket for the same finding.
For ordinary bugs or account issues, such as a broken feature or a failed trade, open a regular support ticket instead. Bounties don't apply there.
For scope, severity and the full terms, see the Bug Bounty & Vulnerability Policy (PDF) and Bug Bounty on docs.bankr.bot.